{"id":183976,"date":"2026-10-23T23:40:30","date_gmt":"2026-10-23T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/okolo-10-vyhodnyh-uzlov-tor-byli-vovlecheny-v-ataku-po-perehvatu-ssh-podklyuchenij"},"modified":"2026-10-23T23:40:35","modified_gmt":"2026-10-23T21:40:35","slug":"around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","title":{"rendered":"Aproape 10% dintre nodurile de ie\u0219ire Tor au fost implicate \u00eentr-un atac pentru interceptarea conexiunilor SSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Detaliile incidentului au fost publicate, \u00een urma c\u0103ruia atacatorii au reu\u0219it s\u0103 preia controlul asupra a 333 de noduri de ie\u0219ire din re\u021beaua Tor (\u00een total, \u00een Tor exist\u0103 aproximativ 3000 de noduri de ie\u0219ire) \u0219i s\u0103 organizeze interceptarea traficului necriptat \u0219i redirec\u021bionarea conexiunilor SSH. Atacul a \u00eenceput pe 2 octombrie (vineri seara), dar a fost identificat \u0219i a \u00eenceput s\u0103 fie blocat pe 4 octombrie. Pe 5 octombrie, toate serverele compromise au fost deconectate de operatori sau de c\u0103tre atacatori. Investiga\u021bia a ar\u0103tat c\u0103 atacatorii au avut acces la servere cu dou\u0103 luni \u00eenainte de \u00eenceputul atacului asupra utilizatorilor Tor \u0219i au instalat \u00een sistemele compromise malware-ul Ebury 1.8.3.<\/p>\n

Scopul atacului a fost interceptarea parolelor, cheilor \u0219i informa\u021biilor confiden\u021biale din traficul de tranzit necriptat, precum \u0219i capturarea parolelor SSH. \u00cen analiza traficului necriptat, atacatorii s-au concentrat pe solicit\u0103rile f\u0103r\u0103 criptare c\u0103tre serverele de email. Pentru a stimula re\u00eentoarcerea la func\u021bionarea f\u0103r\u0103 criptare pe nodurile de ie\u0219ire, au fost blocate porturile de re\u021bea utilizate pentru stabilirea unui canal de comunicare criptat cu serverele de email. servers<\/a>. Traficul necriptat a fost analizat \u00een timp real.<\/p>\n

Pentru a colecta parolele SSH, a fost organizat\u0103 redirec\u021bionarea cererilor SSH c\u0103tre unul dintre cele 12 servere ale atacatorilor. Aceste servere acceptau conexiuni SSH \u0219i prezentau solicitarea de parol\u0103 \u00een numele server<\/a>, la care se conecta utilizatorul. Deoarece cheile gazdelor nu corespundeau, ssh-ul de pe partea clientului emitea un avertisment privind conectarea la un server<\/a>. <\/p>\n

Dac\u0103 utilizatorul ignora aceast\u0103 avertizare \u0219i introducea parola pentru conectare, atunci malware-ul serverul<\/a> transmitea prin intermediul s\u0103u conexiunea c\u0103tre serverul SSH \u021bint\u0103 legitim, salva parola introdus\u0103 de victim\u0103 \u0219i intercepta informa\u021biile despre ac\u021biunile din sesiunea SSH. \u00cen paralel, se realiza o conexiune la serverul \u021bint\u0103 cu parola capturat\u0103 \u0219i se instala malware-ul Ebury pe acesta. Ob\u021bin\u00e2nd controlul asupra serverelor Linux care nu erau noduri de ie\u0219ire Tor, atacatorii schimbau set\u0103rile din fi\u0219ierul torrc \u0219i transformau aceste noduri \u00een noi noduri de ie\u0219ire malefice Tor.<\/p>\n

<\/center><\/p>\n

Pentru a identifica toate nodurile de ie\u0219ire mali\u021bioase, cercet\u0103torul care a descoperit problema a folosit utilitarul exitmap pentru a itera prin toate nodurile de ie\u0219ire, stabilind o conexiune SSH prin fiecare dintre ele \u0219i verific\u00e2nd dac\u0103 exist\u0103 o redirec\u021bionare a cererii. Modurile prin care atacatorii au ob\u021binut acces la nodurile Tor compromise nu sunt clare, fiind avansate, printre altele,
\n presupuneri privind compromiterea operatorilor de hosting.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 333 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0437\u043b\u0430\u043c\u0438 \u0441\u0435\u0442\u0438 Tor (\u0432\u0441\u0435\u0433\u043e \u0432 Tor \u043e\u043a\u043e\u043b\u043e 3000 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432) \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043d\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f (\u0432 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 \u0432\u0435\u0447\u0435\u0440\u043e\u043c), \u043d\u043e \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f. 5 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u0441\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0431\u044b\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":183978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aproximativ 10% din nodurile de ie\u0219ire Tor au fost implicate \u00een atacul de interceptare a conexiunilor SSH | ProHoster","description":"Detalii ale incidentului au fost publicate, \u00een cadrul c\u0103ruia infractorii au reu\u0219it s\u0103 preia controlul asupra a 333 de noduri de ie\u0219ire ale re\u021belei Tor (exist\u00e2nd aproximativ 3000 de noduri de ie\u0219ire \u00een Tor) \u0219i s\u0103 organizeze interceptarea traficului necriptat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043a\u043e\u043b\u043e 10% \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 Tor \u0431\u044b\u043b\u0438 \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u044b \u0432 \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 SSH-\u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 333 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0437\u043b\u0430\u043c\u0438 \u0441\u0435\u0442\u0438 Tor (\u0432\u0441\u0435\u0433\u043e \u0432 Tor \u043e\u043a\u043e\u043b\u043e 3000 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432) \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043d\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-23T21:40:31+00:00","article:modified_time":"2026-10-23T21:40:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=183976"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183976\/revisions"}],"predecessor-version":[{"id":183977,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183976\/revisions\/183977"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/183978"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=183976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=183976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=183976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}